COLUMBUS, OHIO, November 11, 2026 — Finite State has closed a $27 million Series C round led by private funds managed by The O.H.I.O. Fund, with CIBC Innovation Banking, Energy Impact Partners, Energize Capital and National Grid Partners participating. The Columbus-based company builds an AI-driven platform that analyzes the firmware actually shipped inside connected devices, rather than relying on build manifests, to help manufacturers manage a surge in AI-discovered vulnerabilities.
The ‘Vulnpocalypse’ Threat
In October, AI-powered research uncovered critical flaws in widely used software, including a vulnerability in the PHP programming language that underpins much of the web. Security leaders have dubbed the surge the “Vulnpocalypse.” According to Finite State, AI has compressed the window between flaw discovery and weaponization from weeks to days or hours. For manufacturers of vehicles, medical devices, industrial equipment and consumer electronics, the urgent question is no longer whether a vulnerability exists, but which of their deployed products contain the affected component.
Binary Firmware Analysis: Scanning What Actually Ships
Modern devices are assembled from open-source libraries, third-party SDKs, board-support packages and legacy code. A build manifest describes what the development process expects to include; firmware analysis examines the artifact that actually results. The difference matters when a supplier modifies a library, a dependency is compiled directly into an executable, or packaging adds a component not listed in the source tree.
Finite State’s platform unpacks firmware images, containers, archives and executables, then identifies components through binary software composition analysis. It also applies static application security testing to compiled code, examining weaknesses beyond a simple list of package names. The resulting inventory captures modified and statically linked components, enriched with vulnerability, exploit and license data, alongside hard-coded credentials, exposed keys and cryptographic issues. Supported inputs include firmware, shared libraries, mobile application binaries and third-party software, as well as source code when available.
SBOM Generation and Vulnerability Intelligence
The platform combines that artifact analysis with vulnerability intelligence and compliance workflows. The aim is to turn an inventory of shipped code into a prioritized remediation decision: not just which known vulnerabilities (CVEs) are present, but which are actually exploitable in the context of the finished device. This moves the conversation from a raw component list to a risk-ranked action plan, a necessary step when a single shared component can sit inside millions of deployed units that are hard to inventory and slow to patch.
Autonomous Platform Development
The Series C capital will accelerate development of autonomous security capabilities designed for continuous risk identification across complex software supply chains. The goal is to scale the process of uncovering the gap between planned and actual firmware, then continuously mitigating the risks that gap creates, across the global operations Finite State already maintains.
Series C Funding Details
The $27 million round was announced November 10, 2026. The O.H.I.O. Fund led the investment through its managed private funds. “Every connected product—cars, infusion pumps, toys, OT, baby monitors, your home router—runs on third-party code and components, making inspection and security exceptionally challenging,” said Mike Venerable, founding partner of The O.H.I.O. Fund. The company did not disclose its valuation.
Regulatory Tailwinds
Demand is also driven by a hardening regulatory baseline. The EU Cyber Resilience Act, FDA premarket cybersecurity requirements for medical devices, UNECE R155 and R156 for vehicles, and IEC 62443 for industrial systems all place the burden of proof on the manufacturer. Security must be demonstrated before a device ships rather than added after it reaches the market. The cost of falling short includes blocked market access, recalls and liability. Finite State’s platform generates software bills of materials, vulnerability exploitability documentation and compliance evidence to meet those mandates.
Sources
- Finite-state machine
- Finite State Raises $27 Million Series C to Expand AI-Powered Device Security Platform
- Finite State Raises $27 Million Series C to Expand AI-Powered Device Security
- Finite State Raises $27 Million to Help Device Makers Fight the ‘Vulnpocalypse’ with AI-Powered Product Security – AOL
- Finite State Raises $27 Million to Help Device Makers Fight ‘Vulnpocalypse’ with AI-Powered Product Security
- Two Qubits May Simulate A Black Hole’s Mass Spectrum
Photo: Boitumelo / Unsplash (Unsplash License)
